TAG-195 Upgrades MaaS Ecosystem with Modular Tools

Summary

The TAG-195 malware-as-a-service (MaaS) developer has shifted toward a modular architecture, introducing four new malware families: TinyEgg, ChonkyChicken, a modularized ChonkyChicken variant, and ChromEggscalator. These tools support initial access, browser credential theft, and persistent surveillance through a controller-and-plugin framework. This evolution is designed to reduce exposure to static detection while enabling operators to deploy only the capabilities required for each intrusion.

Investigation

Insikt Group tracked the development of the TAG-195 ecosystem by examining the new malware families and their shared architectural characteristics. The investigation uncovered consistent command-and-control methods, filename-based execution gating, and a common persistence model across the newly identified families. Analysts also connected the tooling to earlier TAG-195 activity and established delivery techniques, including ClickFix campaigns.

Mitigation

Defenders should restrict or disable access to the Windows Run dialog and prevent regsvr32.exe from loading .dll or .ocx files from user-writable directories. Monitoring for suspicious Run keys such as WinComCtl and associated log files in %TEMP% or C:\ProgramData is recommended. Deploying FIDO2-based MFA and rotating compromised credentials can further reduce the impact of browser credential theft.

Response

If TAG-195 activity is detected, responders should prioritize reviewing active Chrome DevTools Protocol (CDP) sessions and unusual outbound WebSocket traffic over non-standard ports. A forensic examination of %TEMP% and C:\ProgramData should be performed for relevant debug logs. Credential rotation should also include immediate session termination to prevent attackers from retaining access through hijacked browser sessions.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary has gained initial access and aims to deploy the ChromEggscalator payload to facilitate credential theft. To evade simple file-based detection, the attacker leverages the Living-off-the-Land Binary regsvr32.exe. They drop a malicious OCX file named chromelevator.ocx into a temporary directory and execute it via the command line. This action is intended to bypass application whitelisting and trigger the specific signature identified in the detection rule.

• Regression Test Script:

  # Simulation of TAG-195 ChromEggscalator Payload Execution
  $tempPath = "$env:TEMPchromelevator.ocx"
  
  # 1. Create a dummy OCX file to simulate the payload
  New-Item -Path $tempPath -ItemType File -Force
  Write-Output "[+] Created dummy payload: $tempPath"
  
  # 2. Execute regsvr32 to register the malicious OCX (Triggers Detection)
  Write-Output "[+] Executing malicious regsvr32 command..."
  Start-Process "regsvr32.exe" -ArgumentList "/s $tempPath" -Wait
  
  Write-Output "[+] Simulation command executed."

• Cleanup Commands:

  # Cleanup the simulated malicious file
  Remove-Item -Path "$env:TEMPchromelevator.ocx" -Force
  Write-Output "[+] Cleanup complete: Malicious file removed."